Introduction
This article explains what to do when PURLs in rl-json files are incorrect, incomplete, or replaced with placeholders for software components. Spectra Assure generates PURLs from package manifests, so issues in the source metadata can affect the SBOM output.
Issue description
You may see discrepancies in the PURLs generated for one or more software components in rl-json files. In some cases, package.json files may contain placeholder values or non-conformant package names, which can lead to incorrect PURLs being propagated into the SBOM.
Signs
PURLs do not match the expected software component name or version.
Placeholder values appear in package.json files and are reflected in the rl-json output.
The SBOM contains non-conformant or unexpected package identifiers.
Different scans of the same component produce inconsistent PURLs.
Basic troubleshooting steps
Use the following checklist to help isolate the cause of the issue:
Confirm that the package manifest contains the correct package name and version.
Check for placeholder values in package.json or related manifest files.
Verify that the package name follows the expected naming conventions for the ecosystem.
Re-run the scan after correcting any manifest data issues.
Advanced troubleshooting steps
Step 1: Validate the source manifest
Review the package manifest used during scanning and confirm that the package name, version, and other identifying fields are accurate and non-placeholder values.
Step 2: Compare the generated rl-json output
Compare the rl-json file against the original manifest to identify where the PURL diverges from the expected component metadata.
Step 3: Escalate suspected validation bugs
If the manifest is correct but the generated PURL is still wrong, the issue may be related to package name validation. In that case, collect the affected rl-json file, the source manifest, and the expected PURL for review.
Current status
Spectra Assure identifies software components and generates PURLs based on package manifests. If PURLs are incorrect or placeholders are used, it may be due to bugs in the package name validation. The engineering team is reviewing the issue and will add additional guardrails to prevent non-conformant names from being propagated to the SBOM.
Contact support
If you continue to see incorrect PURLs after validating the manifest, contact support with the affected rl-json files, package manifests, and examples of the expected output.
Additional resources
Related resources may include SBOM generation documentation, package manifest requirements, and release notes for updates to PURL validation behavior.